Ensuring the security of Internet users and Internet connected devices is one of the grand challenges facing us today. The current state of affairs is very problematic, as our cyber-security infrastructure is easily and routinely subverted by cyber criminals, resulting in great economic loss. Every year brings deeper and more complex dependence by society on our cyber-infrastructure, and yet at the same time the cyber-security problem only worsens as the capabilities of the cyber-criminal mature. In effect, we are building mission-critical dependence into virtually every aspect of human activities on a cyber-infrastructure that is very insecure at its core.
The current state of our cyber-security infrastructure is due to two fundamental limitations. The first limitation is a fundamental mismatch between the design assumptions made by computer security programmers with how the vast majority of users interact with the cyber-infrastructure (the “Security Model Complexity” problem. The second limitation is a lack of appropriate isolation of code and data from trusted and untrusted sources in modern computer systems (the “Lack of Isolation” problem). These two limitations of current systems are somewhat orthogonal, but are both very important for securing an endpoint. The “Lack of Isolation” problem, in particular is very important because modern computer systems that are used for everyday computing as endpoints are typically general purpose devices capable of running a vast variety of software from different sources.
The general purpose capability of modern endpoint systems is constructed using a layered stack of hardware and software. An example of the layered arrangement of hardware and software that is present in modern computer systems is shown in FIG. 1. At the lowest layer, there is hardware with a small number of basic general purpose programming capabilities. Upon this hardware layer sits the firmware and operating system (OS) layers. The firmware and OS layers provide higher-level but broad capabilities such as managing specific devices, files, and/or processes. On top of the OS layer run the various applications which provide user-visible rich functionality to the computer. The functionality provided by the application layer is typically the primary concern of the computer user.
One advantage and consequence of the layered nature of modern computer systems is that the various layers may come from different vendors, as long as the layers conform to the specifications governing the layer boundary (which may be based on open or proprietary industry standards). To illustrate an example, in a typical PC today the hardware may be constructed around processor and chipset technology provided by Intel or AMD. The firmware/BIOS may be provided by companies like Insyde, AMI or Phoenix and may be written to conform to several industry specifications such as UEFI and PI. The operating system (OS) may originate from a company like Microsoft or Apple or may be a flavor of the Linux open source OS. Finally, the applications themselves are usually written to the specification of one of the operating systems and may be provided by one of a large multitude of application vendors.
Note that some of the applications may themselves have a layered architecture. A web browser, for example, typically includes a browser core and may also download web applications in the form of HTML, Javascript and Flash programs from various Internet web sites. The web browser may run these downloaded web applications locally on top of the browser core. A typical web page contains HTML with embedded JavaScript that can change the HTML being rendered by the web browser dynamically based on user actions without having to re-download the web page from the web server. The HTML may also demarcate part of the web page to be rendered by a plugin, which is typically a separate program that is installed on the computer. Plugins are also often downloaded from different sources over the World Wide Web. Thus, a modern computer runs code that comes from a variety of different sources. In particular, application programs may originate from literally millions of different sources once we consider the collection of traditional local applications as well as web applications that are downloaded from websites.
The integrity of a computer system when it runs application code from different sources (or even the same program being run by different users of a shared computer) has traditionally been one of the responsibilities of the OS. The OS uses various hardware and software constructs like virtual memory, processes, and file permissions to prevent code and data belonging to one program (or user) from affecting code and data belonging to another program (or user). This responsibility of the OS to “isolate” programs and data from one another often tends to compete with another responsibility of the OS, which is to allow for co-operation between programs especially between user application programs and system level services such as shared library modules, database services, and other higher-level common OS functionality. These two OS functions, to share and to isolate, require the OS designer to make some tradeoffs on how much to share and how much to isolate.
As a result of these tradeoffs, the resulting implementation of modern operating systems tends to be overly complex and typically exhibit numerous bugs. In mature operating systems, the security implementation is typically robust enough to work well for normal programs under normal usage with no adverse impact on the operation of the computer. However, most OS implementations are very large and complex bodies of computer code. For example, an OS implementation may have thousands of loopholes that cause a security system to break down under situations where programs are especially constructed to take advantage of less-tested or unvalidated corner cases in the operation of the security subsystem. Furthermore, the security implementation of modern operating systems does not perform well when all programs are initiated by the same user.
These “security vulnerabilities” are not important for well behaved programs during typical operation, but are used extensively by cyber criminals to subvert the computer's security subsystems. Once the system's security is subverted, it is generally possible for cyber criminals to run any software under their control on the subverted computer system.
The Lack of Isolation problem is made worse by the fact that a large amount of code executed by computers today comes from sources outside the computer, some of which have explicit intentions of committing criminal activities. This includes any program downloaded from the Internet or any web site visited by the computer. All downloaded programs (good and bad) have the same OS and library services available to them to use during their operation. Consequently, any program (even malware), can exploit any security vulnerability in the complex OS or web browser environment and subvert the security subsystem that isolates applications from one other. For example, when a user visits a web site, he or she is really running web application code developed by the publisher of the web site. If this web site is malicious, then malware may be executed on the computer. Malware may be designed to exploit a security vulnerability in the web browser to take control of the computer system during subsequent web site visits, e.g., if you visit your bank's web site, your key strokes may be captured and your login/password information for the bank may be transmitted to the malware publisher.
Most computer security professionals understand the existence of the Lack of Isolation problem, but consider it hard to solve in any practical way because better achieving the goal of isolation between applications fundamentally tends to conflict with achieving the goal of increasing seamless communication between different local and web applications. There has been some work towards the isolation of web code from different sources being run by a web browser. Modern browsers have attempted to create a level of sandboxing around downloaded web application code in order to isolate downloaded code from the rest of the computer and from each other. However, these models are fairly primitive in their ability to deal with the full gamut of security issues that arise during the course of a typical user's web experience. For example, certain versions of Google's Chrome web browser's sandboxing does not address safety issues arising from downloaded browser plugins and various types of native executables; thus, every computer system running certain versions of Chrome is vulnerable to a zero day exploit attack against Adobe Flash or Microsoft Word as much as if the system was running a less secure or older browser with the same Adobe Flash Plugin or Microsoft Word plugin.
Web browsers have been burdened with the need to ensure full compatibility to older and non-standard web pages in their efforts to provide superior safety and privacy. For example, web browser programmers have had to make some relaxations around the same-origin policy in order to correctly render popular web sites that rely on the sharing of information between web sites.
Last but not least, most web browsers vendors suffer from a huge conflict of interest because their business relies upon monetizing the web browsing habits of their users within their own business processes and with their industry partners. This monetization relies on data about users' browsing habits which is contained in the web cookies that are set and later provided to web servers during the course of web sessions. Companies such as Google and Microsoft have a great interest in learning as much as possible about a person's browsing habits and typically arrange the default privacy settings of web browsers to be advantageous to them (but less than optimal from a security and privacy standpoint). This choice of default privacy and core functionality settings causes web browsers to transfer large amounts of sensitive information from end users' machines to Internet related businesses, such as Google, Microsoft, Apple, etc., thereby allowing such businesses to better monetize their customer base by offering appropriate products and services and serving targeted ads. These same settings, however, can be leveraged by malicious parties to exploit security vulnerabilities. While all web browsers provide some level of control to the sophisticated user to tune his or her web browser functionality and/or privacy/safety settings to browse more securely, the vast majority of users never change these default settings.
Some security researchers have also proposed the use of “client virtualization” (also called “Virtualization using a Hypervisor” in the desktop) to solve the Lack of Isolation Problem. In one form of client virtualization, the user runs multiple independent operating systems on their laptop or desktop on multiple virtual machines (VMs) within the client system which have been created using a hypervisor, such as from VMWare of Palo Alto, Calif. or Virtual PC, available from Microsoft Corporation of Redmond, Wash. When client virtualization is used to achieve improved security, different VMs are used to run applications from different sources or of different types. For example, an OS in one VM may be dedicated for accessing the corporate network that the user may be part of and running corporate applications (local and web). Another OS in a second VM might be used by the user to run his or her personal programs and store personal documents. Finally, a different OS in a third VM may be used for general web browsing on the wider Internet and running native executables that may have been downloaded from the Internet. An example of such a solution is XenClient, which is made by Citrix Systems of Ft Lauderdale, Fla.
The use of classical client virtualization, as discussed above, to solve the general code isolation problem in the context of Internet endpoints suffers from several drawbacks. A first drawback is that there is too much management overhead for the end-user. The end-user has the onus of making the decision as to what VM to use for each activity. Any mistake, intentional or accidental, may subvert the integrity of the system. While many safeguards can be added as a layer on top of the core virtualization technology to prevent the user from making mistakes, this has not yet been demonstrated to work in a practical and robust fashion.
Another drawback is that this arrangement of VMs is very static and does not lend itself to the dynamic and varied nature of the typical user's activities. For example, depending on the time of the day, many users may need to isolate programs from 2 sources to 10s of sources. In the arrangement described above, there is no VM based isolation between all the web sessions of the user on the general Internet. Running 10s of VMs on a single client system all the time leads to too much performance and management overhead using prior approaches. Starting VMs on demand for individual activities suffers from huge latencies to start activities and a limitation on the number of concurrent activities supported, which adversely affects the user experience.
An additional drawback is that client virtualization, as described above, suffers from the problem that any VM that is used for general web browsing is just as vulnerable to a security problem as any monolithic system running a single VM while accessing web sites on the general Internet. Therefore, it is quite likely that the VM dedicated to web browsing described in the arrangement above will be subverted by malware eventually. Any subsequent activities in that VM, then, will be compromised.
Due to these reasons client virtualization has not been used widely to improve the security of Internet endpoints.